Kaspersky Endpoint Detection and Response Optimum
Build true defense-in-depth and boost security efficiency by using automated response and simple root cause analysis

Essential EDR functionality

Start building your incident response capabilities with simple, automated EDR features.

• Clear visibility – discover threats on endpoints
  Avoid getting stuck in the black box – get vital information on automatic detects and find lurking threats with Indicators of Compromise (IoC).
• Simple analysis – investigate the full scope
  Perform root cause analysis in a single incident card to understand where a threat came from, how it developed and what it managed to do.
• Automated response – act quickly to avoid damage
  Use easy ‘single-click’ actions and in-product guidance to prevent threats from spreading – and automation to respond to threats on discovery.

Cloud native solution

Raise security efficiency and ease deployment without adding IT complexity.

• Delivered from the cloud
  Adapt to your environment with cloud and on-premise deployment options and centralized unified management.
• Secure cloud workloads
  Enhance your cyber defenses for virtual and physical servers, VDI deployments and public cloud workloads with essential EDR functionality.
• Save resources
  Make full use of available security bandwidth and start building your essential incident response processes with a simple, centralized, streamlined tool.

Quickly find out if you’re under a new attack

With Kaspersky EDR Optimum you can import the IoCs of the latest attacks from external sources like securelist.com, and run periodic scans across your infrastructure to discover and respond to threats instantly. The same can be done when a regulatory authority requires scans for specific indicators.

Find out if the threat is more than you thought

Once a threat is automatically detected and remediated, you might want to take a closer look at it. When it comes to evasive threats, often detectable payloads are dropped by inconspicuous parent processes, which can cause significant damage if undetected. Investigation tools allow you to quickly analyze detects and find their true root cause.

Am I under attack?

• Advanced detection – based on machine learning, including cloud sandboxing – automatically detects threats.
• Download and scan IoCs from securelist.com or other sources to find advanced threats.

Can I neutralize it?

• Utilize multiple response options – isolate host, prevent file execution or remove it.
• Scan other hosts for signs of the analyzed threat.
• Apply an automatic response across hosts on discovering a threat (IoC).

How do I get some skills training?

• Check out the response guidance in the alert card.
• Access the Threat Intelligence Portal and the latest TI.
• Develop your expertise as you analyze and respond to threats.

How did it happen?

• Analyze the threat in a visual process tree.
• Track its actions in a drill-down graph.
• Understand its root cause and entry point into the infrastructure.

How do I stop it ever happening again?

• Put learnt information to use – knowing which IPs and websites to block, policies to modify and employees to train.
• Create rules for preventing such threats in the future, e.g. prevent file execution.

What about all the commodity threats?

• Next-gen endpoint security is on board to stop most threats right away.
• Step up your patching with Vulnerability and Patch Management.
• Automate your attack surface reduction and policy adjustment with endpoint controls.